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OFFICE OF THE ASSISTANT TO THE SECRETARY OF DEFENSE 

1 400 DEFENSE PENTAGON 
WASHINGTON, D.C. 20301-1400 



Ref: 95-F-0691 



19 MAY 1995 




PUBLIC AFFAIRS 



Mr. David A. Banisar 

Electronic Privacy Information Center 
666 Pennsylvania Avenue, SE, Suite 301 
Washington, DC 20003 

Dear Mr. Banisar: 

This letter responds to your March 24, 1995, Freedom of 
Information Act (FOIA) request which was received in this 
Directorate March 27, 1995. 

The enclosed documents are provided as responsive to your 
request. 

There are no chargeable costs for processing your FOIA 
request in this instance. 



Sincerely, 




R-rtL. PassareTxa 
Director 

Freedom of Information 
and Security Review 



Enclosures : 
As stated 




OFFICE OF THE DEPUTY SECRETARY OF DEFENSE 
The Military Assistant 
31 August 1994 

MEMO FOR: MR. KEITH HALL, DASD/I (C3I) 
Subject: Invite from NRC/NAS 70ct94 

Mr. Deutch's comment on the attached Invitation: 
"Regret: JMD - Give to Keith Hall" 



Very respectfully, 




Pat Kane 
Colonel, USA 
Military Assistant to the 
Deputy Secretary of Defense 



Attachments 

OSD 17592 



SUSPENSE: 



iVATIONAL RESEARCH COUNCILWATIONAL ACADEMY OF SCTFNCES 
COMPUTER SCDENCE AND TELJECO^IMUNICATIONS BOARD j 
2101 CONSTTTUrrON AVE., N.W., WASHINGTON, D.C. 2041S 
TELEPHONE: (202) 334-2605 FAX: (202) 334-2318 

DATE: Auouiii 29, 1994 NUIVLBER OF PAGES iiNCLUDLNG THIS SHEET: 2 

TO: John Deutch c/o Lynn Cliiie 703-697-9080 FRONL Herb Lin (202-334^3191 voice) 

Professor Deutch: 

A:i yuu may tmow by now, the NRC's corrrmrUec lo study tianouai cryptography policy has been 
formed (and a List of the cormidttee anached). The first meeting of the committee will be m October, 
and since you had expressed an interest in meeting with the committee to provide DOO perspeoxves 
on die subjecr, I am writing to soUcit your parricipadon ar this meeting. In panicukr. we wouFd like 
you to meet with Uie committee on Friday, October 7, some time in the morning, probably around 
10:30 AM for about an hour (inclnding discussion widi die comnunee), at die Georgetown facility of 
die NRC. You should also know that we are trying to arrange bnefings from odier agencies (e|:g.. 
State and Justice), as well as from the intelligence conmiunit>'. 

Your participation at this briefing would be enormously helpful to the committee. 
ThanJcs in advance. 



Herb Lin 

Study Director and Senior Staff Officer 




(TBioiT^mes are being updaied) . - 

I 

. • ^ c^^^ro^n; nf Si;uc' avS'^-l^>85) and Ls clicrcaUy diet Max 

cbe U.S. European Coamaiid in Germany. 

, Bollinger is Provost of Darunouih CoUege and a coosurutioual scholar. 
Ann Caracristi. reared. wu.s Depur>- Dnector of the Nationai Security Agency (1980-1982) 
^^.^.CMm -as U.S. Aaomey C3.ncral (1979-1981). and .s currently m private pracdce .icb 
the law firm Veoable. Baeqer, Howard and CiviJetti. 

CoUn Crook is Senior Technology Officer for Ciricorp 

Samuel Fuller Vice President of Corponue Research at Digiu.) Hqmptoent Corporation. 

Leshe Gelb . President of the CouncU on Foreign Rela.ocs. He has al.o served as an Assistant 
Secretary of State for Polidco-MiUiary Affanrs (1977-1980). 

I^gsaJdGsham is professor of matbemancs at Rutgers University and Adjunct Direaor of 
Information Sciences ai AT&T Bell Labs . 

Martin Helhnan is professor of Hectrical Eagineertng at Stanford University. Dr. Helhnan was one 
of die inventors of pubUc key cncrypoon. 
„„.,.Kalz . Pr=.,cie« of HiUs & Co„,p.ny, =.0 was Depun UoU=d Stn.« Trade Repr=se„ac^= 

(1989-1993). 

crypto policy . 

Ravmood Ozz^e is president of Iris Associates, a wholly-owned subsidiary of die Loms Devdopmcnt 
Corporation. Iris Associates is the developer of Lotus Notes. 

Kumar Patel is Vice Chancellor for Research at UCLA. 

HdwardSchmults . retired, was Deputy Aaomey General (^9™ 
President for ExTemal Relations and General Counsel for the GTE Corporation. 

Elliot Stone is Executive Direaor of the Massachusetts Healdi Data Consortium which is respJnsible 
for die coUection and analysis of the state's large hwildi cire databases. j 
Wilds Ware retired, is widiRA>n:) Corporation as senior corripmer scientist eoieri^^ He chairs the 
SSf ^t^pm^^Security Act) Coniputer System Secunry and Privacy Advisory Board. 



Remarks for 
Mr. Keith Hall, DASD(I&S) 
on the 

NRC's Study of National Cryptography Policy 
7 October 1994 




# On behalf of Dr. John Deutch, the Deputy Secretary of Defense, I am 
pleased to welcome you to Washington, and honored to be here to address the 
NRC 's National Cryptography Policy Study Team. 



0 In its 1991 Publication "Computers at Risk," the National Research 
Council noted that: ". . . the Government 's efforts /in securing its information ^ 
infrastructure J have been hamstrung by internecine conflict and underfimding " 
The NRC continued by stating: "These problems currently appear to be 
exacerbated, at precisely the time that decisive and concerted action is needed 
A coherent strategy must be developed now, given the time, resources, planning, 
and coordination required to achieve adequate system security and 
trustworthiness. " 

# For its part the Department is reviewing its ability to provide 
additional resources designed to secure a significant portion of the Defense 
Information Infrastructure from attack. 

# In studying national cryptography policy you have been charged with 
developing policy recommendations in arguably the most strategically 
important, technologically dynamic, difficult and complex subject areas in the 
Defense arena. In addressing them I suggest to you that the Defense 
Department is not . . on the outside looking in" on your study 

# We have a stake in every facet of your study: 

— as customers of cryptography, to include Key Escrow 

technologies. 



1 



— as being increasingly dependent on the Public Switched 
Network/National Information Infrastructure, 

~~ and as the Department assigned the responsibility of securing 
the nation 's and the public 's freedoms in a rapidly changing 'information 
based" world. 

# The Department 's stake is not parochial. It is a matter of concern to 
the American people, for to the extent that our Defense Information 
Infrastructure is placed at risk, so too are the lives of the Service men and 
women who serve on our front lines. 

~~ Accordingly, DoD is committed to working with you, within the 
government, and with industry in developing and implementing technologies 
such as Key Escrow and national cryptography policies that enhance the 
security of the nation, the freedoms of its citizens, and the competitiveness of its 
industries. 

# In defining the Department 's perspective on the study, I thought it 
would be useful to address briefly some of the key provisions of your task, the 
first being: 

The Impact of current and possible restrictions on and standards 
for cryptographic technology. 

# The Department is not in the business of restricting US industry, its 
citizens, or its technologies. We do not see the competitiveness of US industry 
as exclusive from, or opposed to, national security interests. Changes in 
industrial security, for example, are aimed at promoting the concept that sound 
security is a joint concern of the department and its industrial infrastructure. 
We are actively developing revised security arrangements that treat this matter 
as a Defense/Industry partnership. 

0 Given the diversity and competency of this study team, there are great 
expectations regarding your ability to develop recommendations which keep 
industry competitive, and enable the Department and law enforcement agencies 
to maintain the nation 's security, and the safety and privacy of its citizens in an 
increasingly invasive information age. 
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The strength of various cryptographic te<=hnolog.es known today 
and anticipated for commercial and private purposes, and the 
^n js and weaknesses of current Key Escrow pians. 

• We believe Clipper with its Key Escrow technology provides the 
strenJhZlL^ to prZct American commmications now Ml fojte 

P^l^e^to examine the Government 's position and vahdate tts truth. 

Current and anticipated demand for information systems security 
based on cryptography. 

• This "demand" needstobeconfirmedandcleariydocmented. I 
have no, seen any specific evidence suggesting the size of the potennal marke 
Ze TZgh lL Lare that certain industry representatives teteve ,r ,s 
we iZJbe interested in seeing your results. Anecdotal comments 
IZrdZthepotentialfor overseas commerce in cryptography ccm not be a 

bMll'mstratim cryptographic policy decisions that could ad^ersefy 
TclLemmenfs ability to protect tndivtdual libert.es. ensure pubhc safety. 
Ldevelop timely intelligence on events transptnng ""'''"g'"'"' _ 
Tcreasiniy unstable world The bottom line on this tssuejs: The nmton 
^Zffordto trade critical intelltgence capabilities and its securtty for the 

possibility of increased commerce. 
Your tasks also ask you to assess: 

The impact of foreign restrictions on the market for, importation, 
Ind u^e <rf our cryptographic technologies, and the adequacy of US 
cryptographic and cryptographic export policies. 

- Given the reality of global connectivity, the Department, sveo' 
interested in your findings on the formation of foreign cryptographtc pohces 
ZC they impact u^n [foretpt] nattonal security et^it.es. the destres of the 
TlZrc7sector and on private cttizens. We will also be mterested ,n any 
aff„^ may find between stated policy(ies) andon ho. the poltcy(,es) ,s 
(are) actually implemented. 

Having determined foreign government cryptographic policies and 
their actual implementation of them, you will be in a good position to 
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accomplish your assessment of the adequacy of our own cryptographic policies 
in meeting the interests of the Government, business and the public. 

How technology now and In the future affects policy for balancing 
US security, law enforcement, privacy, and commercial interests. 

0 Ida not need to emphasize the technologically driven nature of the 
issue. However, I must again emphasize that defense of the nation, law 
enforcement, and the privacy and safety of US citizens are not (as conventional 
wisdom and even the wording of the study issue strongly suggests) mutually 
exclusive interests. In fact, the widely reported concerns of Americans over 
crime and their safety constitute a very close relationship between our citizens, 
the law enforcement and national security communities. Far from being against 
measures designed to enhance their security, safety, and privacy, Americans 

are for them. 

• Discuss the need for cryptographic technologies and policies that help 
to secure the National Information Infrastructure in an increasingly 
interconnected world. The Department and the nation 's security, economic 
health, our standard of living the safety and freedoms of our people are 
increasingly dependent on the security of the NIL 

• Key Escrow does not signal the arrival of "Big Brother. " As recent 
INTERNET break-ins illustrate, "big brothers, " not identifiable or subject to US 
laws, are currently active and are "into " your lives. Unless checked by security 
technologies such as CUPPER and its Key Escrow, these "big brothers" could 
soon seriously affect the nation 's security, your safety, businesses, privacy and 
bank accounts. 

0 Because of this, throughout your study efforts take a close look at 
information as a commodity. Information and data (as used in control systems 
from building air conditioners, to the air traffic control system, to the national 
power grid) and its integrity, availability, and accuracy is the key to this 
nation 's way of life -In short, it is America 's lifeblood. 



0 I ask you to consider: 
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~~ The increasing technological pace of information and digital 
control systems development. Information and data technologies are rapidly 
becoming ubiquitous. 

The domination of information workers over those in the 

manufacturing sector. 

— Mobile/cellular communications and electronic leashes 

(pagers) 

— All held together by an increasingly vulnerable/high- 
value/high payoff target - the nation 's public switched network. 

0 Information, and the systems in which it is processed, has had 
profound effects on warfighting The very essence of war and national security 
is being transformed as I speak 

— National Strength: Has transformed from 
Industrial/Economic Supremacy to Information Supremacy 

~~ Threats to the nation: Have transformed from Superpowers 
and Regional powers to Supranational and non-government organizations. 

— Weaponry: Has transformed from bombs and bullets to bits 
and bytes/zeros and ones. 

— Attack planning and execution: Has transitioned from 
months, weeks, and hours to hours, minutes, and seconds. 

~~ Command and Control: Has transformed from 
organic military and driven by military requirements, to Industrial based/COTS 
and driven by the marketplace. 

— Enemy Objectives: Have transformed from Damage to C2 
systems and forward deployed US Forces to Damage, corruption, and 
destruction of the domestic infrastructure. 

— Attacks: Have transitioned from wartime to continuous. 
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— Attackers: Have transitioned from well defined/known 
adversaries to anyone - any group - any nation. 

# Keep in mind the international nature of Information Warfare 
(INFOWAR) activities. The ability to wage devastating Information Warfare 
attacks against a nation like ours - increasingly dependent on its information 
systems and supporting public infrastructure - does not require superpower 
status. Bear in mind: 

~~ The ability to wage INFOWAR to deny, deceive and/or exploit 
information and the systems in which they reside, is not restricted to economic 
superpowers. Through global communications people, interest groups, and 
nations without great resources can currently safely play very destructive and 
theoretically decisive roles. 

~~ NSA estimates 95% of all illegal entries into DoD information 
systems are undetected 

— The need for the United States to maintain Information 
Warfare and Information System Security superiority. 

0 Asa concession to my sense of symmetry, since I began this talk with 
a quote from the NRC, I feel obligated to close with one from the Joint Security 
Commission. The quote frames the challenges and responsibilities you 
shoulder in developing recommendations to guide the development of national 
cryptography policy, and clearly states the stakes for the nation in the 
information age. 

— "This technology [inforrnation warfare] is capable of 
deciding the outcomes of geopolitical crises without the firing of a single 
weapon. Our security policies and processes must protect our ability to 
conduct such infowars while denying the enemy that same advantage, " 

# Again, on behalf of Secretary Deutch, It has been my pleasure to be 
here - In the time I have remaining, I would be happy to entertain your 
questions regarding the Department 's perspective on your study. 
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ASSISTANT SECRETARY OF DEFENSE 

WASHINGTON. D.C. 20301-3040 

November 8, 1994 



COMMAND. CONTROU. 
COMMUNICATIONS 
AND 
JNTECl-lGENCE 



Honorable Dennis DeConcini 

Chairman, Select Committee on Intelligence 

United States Senate 

Washington, DC 20510 

Dear Mr. Chairman: 

Section 267 of the National Defense Authorization Act 
for Fiscal Year 1994 directed a 30 month Comprehensive 
Independent Study of National Cryptography Policy be 
conducted by the National Research Council (NRC) . 
Accordingly, the NRC's study team held their first meeting o 
October 7, 1994. 

The Department is fully supporting the NRC's efforts. 
We expect the NRC to complete the study and submit its publi 
report and the classified annex to it not later than May 31, 
1997. The Defense Secretary's report to the Committee will 
follow within 120 days. 



Sincerely, 




CC : 

Honorable John Warner 
Ranking Minority Member 



ASSISTANT SECRETARY OF DEFENSE 

WASHINGTON. D.C. 20301-3040 

November 8, 1994 

COMMAND. CONTROU. 
COMMUNICATIONS 
AND 
INTELLIGENCE 

Honorable Joseph Biden Jr. 
Chairman, Conunittee on the Judiciary 
United States Senate 
Washington, DC 20510 




Dear Mr. Chairman: 

Section 267 of the National Defense Authorization Act 
for Fiscal Year 1994 directed a 30 month Comprehensive 
Independent Study of National Cryptography Policy be 
conducted by the National Research Council (NRC) . 
Accordingly, the NRC's study team held their first meeting on 
October 7, 1994. 

The Department is fully supporting the NRC's efforts. 
We expect the NRC to complete the study and submit its public 
report and the classified annex to it not later than May 31, 
1997. The Defense Secretary's report to the Committee will 
follow within 120 days. 

Sincerely, 



CC : 

Honorable Orrin Hatch 
Ranking Minority Member 




ASSISTANT SECRETARY OF DEFENSE 

WASHINGTON. D C. 20301-3040 

November 8, 1994 

COMMAND. CONTROU. 
COMMUNICATIONS 
AND 
INTEUl-lGENCE 

Honorable Sam Nunn 

Chairman, Committee on Armed Services 
United States Senate 
Washington, DC 20510 

Dear Mr. Chairman: 

Section 267 of the National Defense Authorization Act 
for Fiscal Year 1994 directed a 30 month Comprehensive 
Independent Study of National Cryptography Policy be 
conducted by the National Research Council (NRC. 
Accordingly, the NRC's study team held their. first meeting on 
October 7, 1994. 

The Department is fully supporting the NRC's efforts. 
We expect the NRC to complete the study and submit its publxc 
report and the classified annex to it not later than May 31, 
1997. The Defense Secretary's report to the Committee will 
follow within 120 days. 



Sincerely, 




cc : 

Honorable Strom Thurmond 
Ranking Minority Member 





ASSISTANT SECRETARY OF DEFENSE 

WASHINGTON. D C. 20301-3040 

November 8, 1994 



COMMAND. CONTROL. 
COMMU NIC ATIONS 
AND 
INTELLIGENCE 



Honorable Jack Brooks 
Chairman, Committee on the Judiciary 
House of Representatives 
Washington, DC 20515 

Dear Mr. Chairman: 

Section 267 of the National Defense Authorization Act 
for Fiscal Year 1994 directed a 30 month Comprehensive 
Independent Study of National Cryptography Policy be 
conducted by the National Research Council (NRC) . 
Accordingly, the NRC's study team held their first meeting on 
October 7, 1994. 

The Department is fully supporting the NRC's efforts. 
We expect the NRC to complete the study and submit its pxiblic 
report and the classified annex to it not later than May 31, 
1997. The Defense Secretary's report to the Committee will 
follow within 120 days. 




CO : 

Honorable Hamilton Fish 
Ranking Minority Member 




ASSISTANT SECRETARY OF DEFENSE 



WASHINGTON. D C. 20301-3040 



November 8, 1994 



COMMAND. CONTROL, 
COMMUNICATIONS 
AND 
INTELLIGENCE 



Honorable Dan Glickman 
Chairman, Permanent Select 

Committee on Intelligence 
House of Representatives 
Washington, DC 20515 

Dear Mr. Chairman: 

Section 267 of the National Defense Authorization Act 
for Fiscal Year 1994 directed a 30 month Comprehensive 
Independent Study of National Cryptography Policy be 
conducted by the National Research Council (NRC) . 
Accordingly, the NRC's study team held their first meeting on 
October 7, 1994. 

The Department is fully supporting the NRC's efforts. 
We expect the NRC to complete the study and submit its public 
report and classified annex to it not later than May 31, ^ 
1997. The Defense Secretary's report to the Committee will 
follow within 120 days. 



sincerely, 




cc : 

Honorable Larry Combe st 
Ranking Minority Member 
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ASSISTANT SECRETARY OF DEFENSE 



WASHINGTON. D C. 20301 -3040 



November 8, 1994 



COMMAND. CONTROL- 
COMMUNICATIONS 
AND 
INTEi. LICENCE 



Honorable Ronald V. Dellums 
Chairman, Committee on Armed Services 
House of Representatives 
Washington, DC 20515 

Dear Mr, Chairman: 



Section 267 of the National Defense Authorization Act 
for Fiscal Year 1994 directed a 30 month Comprehensive 
Independent Study of National Cryptography Policy be 
conducted by the National Research Council (NRC) . 
Accordingly, the NRC's study team held their first meeting on 
October 7, 1994. 



The Department is fully supporting the NRC's efforts. 
We expect the NRC to complete the study and submit its pxiblic 
report and the classified annex to it not later than May 31, 
1997. The Defense Secretary's report to the Committee will 
follow within 120 days. 



sincerely, 



CC : 

Honorable Floyd D. Spence 
Ranking Minority Member 
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ASSISTANT SECRETARY OF DEFENSE crrr^r^ IV.^Z- ^3 



COMMAND. CONTROL, 
COMMUNICATIONS 
AND 
INTCI-UISENCC 




GTON. D.C. 20301-3040 



EXECUTIVE SUMMARY 




MEMORANDUM FOR DEPUTY SECRETARY OF DEFENSE 

EMMETT PAIGE, JR., ASD(C3I) 
Prepared by: B. Valeri/OASD (C3I^/ 



FROM : 




D(C3) /ISS/58705 



SUBJECT: Department of Defense Support of the National 
Research Council's (NRC) Comprehensive 
Independent Study of National Cryptography 
Policy -- ACTION MEMORANDUM 

PURPOSE: Pursuant to Congressional direction, forward 
letters to the Secretaries of State, Treasury, 
Justice, Commerce, and Energy, the Director, 
Central Intelligence Agency, and the Directors of 
selected Defense agencies requesting their 
support of the subject study. 



DISCUSSION: 



Congressional language authorizing the subject 
NRC study (Section 267, of the Defense 
Authorization Bill for FY 1994), directed the 
Department of Defense to " . . . cooperate fully 
with the National Research Council in its 
activities. . . " The legislation also 
directed the Secretary of Defense to " . . • 
request all other appropriate Federal 
Departments and agencies to provide similar 
support . " 

The attached letters satisfy Congressional 
direction and will support the successful 
accomplishment of the NEC's study effort. 



RECOI-fl-lENDATION; 



RecoiTjnend that you sign the letters at 

DEPSECDEF ^CISION; 

Approved 
Disapproved 
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DEPUTY SECRETARY OF DEFENSE 



1010 DEFENSE PENTAGON 
WASHINGTON. DC 20301-1010 



1 1 FEB 1995 



MEMORANDUM FOR DIRECTOR. NATIONAL SECURITY AGENCY 

SUBJECT: National Research Council Study of National 
Cryptography Policy 

In the National Defense Authorization Act for Fiscal 
Year 1994 (Section 267) Congress directed that the National 
Research Council (NRC) conduct a comprehensive independent 
study of cryptographic technologies and national 
cryptography policy. 

The NRC is currently under contract to the Department 
and has initiated their data collection activities. The 
successful accomplishment of this study effort will require 
the Department's full cooperation. I am, therefore, 
requesting that you identify an agency point of contact 
(POO to serve as a facilitator for the NRC 's efforts. By 
establishing a direct line of communications between your 
agency and the NRC. we can assist greatly in the development 
of an informed and useful report. 

Please provide the name, title and telephone number of 
the POC to both Dr. Herb Lin of the NRC and Mrs. Barbara 
Valeri, the Department's POC who is the Director for 
Information Systems Security. Dr. Lin can be reached at 
202/334-3191. Mrs. Valeri can be reached at 703/695-8705 
and is available to answer any questions you have have on 
this requirement. 
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DEPUTY SECRETARY OF DEFENSE 

1 OlO DEFENSE PENTAGON 
WASHINGTON. DC 20301-1010 



22 FEB 1SS5 




MEMORANDUM FOR DIRECTOR, DEFENSE INFORMATION SYSTEMS AGENCY 

SUBJECT: National Research Coiincil Study of National 
Cryptography Policy 

In the National Defense Authorization Act for Fiscal 
Year 1994 {Section 267) Congress directed that the National 
Research Council (NRC) conduct a comprehensive independent 
study of cryptographic technologies and national 
cryptography policy. 

The NRC is currently under contract to the Department 
and has initiated their data collection activities The 
successful accomplishment of this study effort will require 
the Department's full cooperation. I am. therefore, 
requesting that you identify an agency point of contact 
(POC) to serve as a facilitator for the NRC's efforts. By 
establishing a direct line of communications between your 
agency and the NRC, we can assist greatly in the development 
of an informed and useful report. 

Please provide the name, title and telephone number of 
the POC to both Dr. Herb Lin of the NRC and Mrs. Barbara 
Valeri, the Department's POC who is the Director tor _ 
information Systems Security. Dr. Lin can t>e reacnea at 
202/334-3191. Mrs. Valeri can be reached at 703/byb-a/UD 
and is available to answer any questions you have have on 
this requirement. 
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DEPUTY SECRETARY OF DEFENSE 



1010 DEFENSE PENTAGON 
WASHINGTON. DC 20301-1010 



1 1 FEB 1935 



MEMORANDUM FOR DIRECTOR, ADVANCED RESEARCH PROJECTS AGENCY 

SUBJECT: National Research Council Study of National 
Cryptography Policy 

In the National Defense Authorization Act for Fiscal 
Year 1994 (Section 267) Congress directed that the National 
Research Council (NRC) conduct a comprehensive independent 
study cf cr^.'ptographic technologies and national 
cryptography policy., 

The NRC is currently iinder contract to the Department 
and has initiated their data collection activities. The 
successful accomplishment of this study effort will require 
the Department's full cooperation. I am, therefore, 
requesting that you identify an agency point of contact 
(POO to serve as a facilitator for the NRC's efforts. By 
establishing a direct line of communications between your 
agency and the NRC, we can assist greatly in the development 
of an informed and useful report. 

Please provide the name, title and telephone number of 
the POC to both Dr. Herb Lin of the NRC and Mrs. Baroara 
Valeri, the Department's POC who is the Director for 
Information Systems Security. Dr. Lin can be reached at 
202/334-3191. Mrs. Valeri can be reached at 703/695-870b 
and is available to answer any questions you have have on 
this requirement . 
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DEPUTY SECRETARY OF DEFENSE 



1010 DEFENSE PENTAGON 
WASHINGTON. DC 20301-1010 



Admiral William 0. Studeman, U.S. Navy 
Acting Director, Central Intelligence Agency 
Washington, DC 20515 

Dear Admiral Studeman: 

In the National Defense Authorization Act for Fiscal 
Year 1994 (Section 267), Congress directed the Secretary of 
Defense to request that the National Research Council (NRG) 
conduit a comprehensive, independent study of cryptographic 
technologies and national cryptography policy. 

The NKC is currently under contract to the Department of 
Defense for the performance of this study and has initiated 
their data collection activities. Because the scope of the 
NRC study involves a wide range of government and private 
sector activities and perspectives, its successful 
accomplishment will depend on the full cooperation of 
departments and agencies outside of ^he Department o. Defense. 
Therefore, I solicit the Central Intelligence Agency s 
cSoperatlin in the study and ask that you identify a point of 
contact (POO to serve as a facilitator for the NRC s efforts. 
3v establishing a direct line of communications between the 
aDorooriate parties within the NRC and the interested 
go?e?^ent entities, we can assist greatly in the development 
of an informed and useful report. 

Please provide the name, title and telephone number of 
your POC to both Dr. Herb Lin of the NRC and Mrs. Barbara 
Valeri, the Department's POC who is the Director for 
information Systems Security. Dr. Lin "^^^%^^^^^!^5!^705 
202/334-3191. Mrs. Valeri can be contacted at 703/695 
and is available to answer any questions you may have on this 
request. 

Thank you for your assistance in this matter. 

Sincerely, 




ohn M. Deutch 




DEPUTY SECRETARY OF DEFENSE 

1 010 DEFENSE PENTAGON 
WASHINGTON. DC 2O3O1-101O 



Honorable Ronald H. Brown 

Secretary of Conimerce 

Herbert C. Hoover Building 

14th Street & Constitution Avenue, N.W. 

Washington, DC 20230 

Dear Mr. Secretary: 

In the National Defense Authorization Act for Fiscal 
Year 1994 (Section 267), Congress directed ^he Secretary of 
Defense to request that the National Research Council (NRC) 
conduc? a com^ehensive, independent study of cryptographic 
technologies and national cryptography policy. 

The NRC is currently under contract to f ^ 
Defense for the performance of this stuay and has initiated 
?he!? data collection activities. Because the scope of the 
NRC study involves a wide range of government and private 
sector activities and perspectives, its successful 
;,ccomDlishment will depend on the full cooperation of 
Separ?menS and agencies outside of the Department of Defense. 
?he?efSre: I solicit the Department of Conunerce' s cooperation 
in the study and ask that you identify a point of contact 
(?0C) to se^ve as a facilitator for the s efforts By 
establishing a direct line of communications between the 
aooropriate parties within the NRC and the interested 
Jo?e?ment entities, we can assist greatly in the development 
of an informed and useful report. 

Please orovide the name, title and telephone number of 
vour POC to both Dr. Herb Lin of the NRC and Mrs. Baroara 
Valeri, the Department' s POC who is the Director for 
information Systems Security. Dr. Lin ^f^^^^/f^^fg^sf^.os 
202/334-3191. Mrs. Valeri can be contacted at 703/695 a'^D 
and is available to answer any questions you may have on this 
request. 

Thank you for your assistance in this matter. 

^incerely, 




John M. Deutch 



DEPUTY SECRETARY OF DEFENSE 

101O DEFENSE PENTAGON 
WASHINGTON. DC 20301-1010 



II \'C 

Honorable Warren Christopher 
Secretary Of State 
Main State Department Building 
2201 C Street, N.W. 
Washington, DC 20520 



Dear Mr. Secretary: 

In the National Defense Authorization Act for Fiscal 
Year 1994 (Section 267), Congress directed the Secretary of 
Defense to reouest that the National Research Council (NRC) 
conduct a comprehensive, independent study of cryptographic 
technologies and national cryptography policy. 

The NRC is currently under contract to the Department of 
Defense for the performance of this study and has initiated 
•-heir data collection activities. Because the scope of the 
NRC study involves a wide range of government and private 
sector activities and perspectives, its successful 
accomplishment will depend on the full cooperation of 
departments and agencies outside of the Department of Defense. 
Therefore, I solicit the Department of State's cooperation in 
the study and ask that you identify a point of contact (POC) 

serve as a facilitator for the NRC s efforts. By 
establishina a direct line of communications between the 
aDprooriate'oarties within the NRC and the interested 
government entities, we can assist greatly m the development 
or an informed and useful report. 

Please orovide the name, title and telephone number of 
your POC to both Dr. Herb Lin of the NRC and Mrs. Barbara 
Vaieri, the Department's POC who is the Director for 
Information Systems Security. Dr. Lin <=^^^t)e reached at 
702/334-3191. Mrs. Vaieri can be contacted at 703/6yb-«/UD 
Ind is available to answer any questions you may have on this 
request . 

Thank you for your assistance in this matter. 

.Sincerely, 



Deutch 





DEPUTY SECRETARY OF DEFENSE 



1010 DEFENSE PENTAGON 
WASHINGTON. DC 20301-1010 




2 2 FE: 19:3 



Honorable Hazel R. O'Leary 
Secretary of Energy 
Forrestal Building 
1000 Independence Avenue, S.W. 
Washington, DC 20585 

Dear Madame Secretary: 

In the National Defense Authorization Act for Fiscal 
Year 1994 (Section 267), Congress directed the Secretary of 
Defense to request that the National Research Council (NRC) 
conduct a comprehensive, independent study of cryptographic 
technologies and national cryptography policy. 

The NRC is currently under contract to the Department of 
Defense for the performance of this study and has initiated 
their data collection activities. Because the scope of the 
NRC study involves a wide range of government and private 
sector activities and perspectives, its successful 
accomplishment will depend on the full cooperation of 
departments and agencies outside of the Department of Defense. 
Therefore, I solicit the Department of Energy's cooperation in 
the study and ask that you identify a point of contact (POC} 
to serve as a facilitator for the NRC' s efforts. By 
establishing a direct line of communications between the 
appropriate parties within the NRC and the interested 
government entities, we can assist greatly in the development 
of an informed and useful report. 

Please provide the name, title and telephone number of 
your POC to both Dr. Herb Lin of the NRC and Mrs. Barbara 
Valeri, the Department's POC who is the Director for 
Information Systems Security.' Dr. Lin ^an be reached at 
202/334-3191. Mrs. Valeri can be contacted at 703/69b-«/U3 
and is available to answer any questions you may have on this 
request. 

Thank you for your assistance in this matter. 



incerely, 




hn M. Deutch 




Honorable Janet Reno 

Attorney General of the United States 

Main Justice Building 

10th Street & Constitution Avenue, N.W. 
Washington, DC 20530 

Dear Madame Attorney General: 

In the National Defense Authorization Act for Fiscal 
Year 1994 (Section 267), Congress directed the Secretary of 
Defense to request that the National Research Council (NRC) 
conduct a comprehensive, independent study of cryptographic 
technologies and national cryptography policy. 

The NRC is currently under contract to the Department of 
Defense for the performance of this study and has initiated 
their data collection activities. Because the scope of the 
NRC study involves a wide range of government and private 
sector activities and perspectives, its successful 
accomplishment will depend on the full cooperation of 
departments and agencies outside of the Department of Defense. 
Therefore, I solicit the Department of Justice's cooperation 
in the study and ask that you identify a point of contact 
(POO to serve as a facilitator for the NRC s efforts. By 
establishing a direct line of communications between the 
appropriate parties within the NRC and the interested 
government entities, we can assist greatly in the development 
of an informed and useful report. 

Please provide the name, title and telephone number of 
your POC to both Dr. Herb Lin of the NRC and Mrs. Barbara 
Valeri, the Department' s POC who is the Director for 
Information Systems Security. Dr. Lin ^^^^^^^^^^^J^.^^.q. 
202/334-3191. Mrs. Valeri can be contacted at 703/695-b/U3 
and is available to answer any questions you may have on this 
request. 

Thank you for your assistance in this matter. 

Sincerely, 




n M. Deutch 




DEPUTY SECRETARY OF DEFENSE 

1010 DEFENSE PENTAGON 
WASHINGTON. DC 20301-1010 




Honorable Robert E. Rubin 
Secretary of the Treasury 
Main Treasury 

1500 Pennsylvania Avenue, N.W. 
Washington, DC 20220 



Dear Mr. Secretary: 

In the National Defense Authorization Act for Fiscal 
Year i 994 tsection 267), Congress directed the Secretary of 
nlfense to request that the National Research Council (NRC) 
cSnduc? a com^ehensive, independent study of cryptographic 
technologies and national cryptograpny policy. 

The NRC IS currently under contract to f PJ[JJ^!^^/' 
Defense for the performance of this study and has initiated 
?heir data collection activities. Because the scope of the 
NRC study involves a wide range of government and private 
sector activities and perspectives, its successful 
^SmDlishment will depend on the full cooperation of 
depaSent^ and agencies outside of the Department of Defense. 
?he?efore I solicit the Department of Treasury's cooperation 
In the study and ask that you ^^f^ify a point of contact 
(POO to serve as a facilitator for the NRC s efforts, uy 
establishing a direct line of communications between the 
^Dproo-ate parties within the NRC and the mterestea 
aovel^^lnl entities, we can assist greatly in the cevelopment 
of an informed and useful report. 

Please provide the name, title and telephone number of 
your POC to both Dr. Herb Lin of the NRC and Mrs. Barbara 
Valeri, the Department's POC who is the Director for 
information Systems Security. Dr. Lin ^an ^^/^^5^|^5!^,o5 
202/334-3191. Mrs. Valeri can be contacted at 703/695 87U5 
and is available to answer any questions you may have on this 
request . 

Thank you for your assistance in this matter. 

Sincerely, 




Jcihn M. Deutch 



NATIONAL ACADBMY OF SCIENCES 

im C»«itntk>. A«.<» WmU.«M. DC 20418 

OFnCE LOCATION: 



May 20, 1994 



Ms. Barbara L. Valeri 
Director of Infonnadott Systems Secunty 
Office of the Assistant Secretary of Defense 
Washington, DC 20301-3040 

RE: Proposal No. 94-154-01; "National Cryptography PoUcy" 
Dear Ms. Valeii: 



TW. letter is in «spons. .0 ^^^JZ^^ 
c„,«in=d in ^^^l of your ^^^^^-'^^^^Z^ b«n by 

. •i^-^i a«y1 AnnlitriltinnS. 



Physical Sciences. Mathematics, and Appbcations. 



1 a. 



1 b. 



1 c. 



1 d. 



SCI Wtets for those committee H^t"^^^^ vdth a strict 

Nominations to Bceive sa clearances ^^^jaSiSStaformation have 

Industrial Security Clearance Office (DISCO). 

PnWic Law 103-160 (The Defense Authorization Act oi t y lyyv, ^ 
SlXil^t of Defense wiU expedite u, .l.e Ml^ ^^nT:^ CounoU 
processing of secmity cle«rsnces that are necessary for the National Researcn 
10 conduct the study. 

«ar«e that access to classified data is contingent on the successfol «>«^Plj^o^«^ 
^^^bX^d checks and investigations and the execution of non-disclosure 

agreements. 

The NRC review process entails two sq«rate but reUUed steps to insure the intellectual 
mtegtity of NRC reports. 

'^•"d^lls why the conunit.ee chose no. .o alter the manuscnpt 



1 f, 



. Tl^e second step is taken by the l^Cs R^^^ 

oomnutt^examines the on^ ^th'^S— ^ done an adequate 
the revised manuscnpt to ensure that toe ^ suggest 

job in responding to reviewer comments. ^ v'T^ fo/t,3^ttal 

changes iteelf. Once the RRC approves a manuscnpt, it is ready 
to the sponsor. 

U^^r^ include Cassmed^^^^^P^^^. 
Clearances wiU be selected as reviewers for those sections contauuns 

1 e Not mcluded in your request 
disclosed. 

2athrough2d. r^,^ naoes 2 and 3 of our proposal under Project Content, 

In addition to the Items listed on pages z ana :) oiuui V 

the study will also address: 
cryptography. 

^ a«i.^otfo»g.r««iotiomoato»seof.i»por«i»of,an<lfl»™rlcc. 

for cryptographic technology. 
* to «Uch intent ctyptogr^yix>Ucyi=ade.I^ for P^^ 

competitiveness. 

4 ,«=hMcalstre„gfts and weaknesses otauren^ 
schemes. 

an appropriate point for the project to consider, 
project 




Elaine M. Smialek 
Contract Manager 



cc: H. Lin 

M. Blumcnthal 




OFFICE OF THE ASSISTANT SECRETARY OF 

WASHINGTON. DC 20301-3040 



COMMAND CONTROU 
COMMUNICATIONS 
ANO INTELLIGCNCE 



i \m V394 

Ms. Elaine M. Smiiek 
Contract Manager, Office of 

Contracts and Grants 
National Academy of Sciences 
2101 Constitution Avenue 
Washington, D.C. 20301-6000 



Dear Ms. Smiiek, 

The Department of Defense has completed its review of your Statement of 
Work (SOW), Proposal No. 94-CPSMA-154, for a 32 Month study entitled 
"National Cryptography Policy. " Recommended changes to the SOW and requests 
for clarification are provided in Enclosure 1. I believe the changes offered will 
satisfactorily address the security concerns of the Department and help promote 
the development of a highly useful product. The Department is Prepared to 
proceed wltfr the study upon agreement on the SOW provisions. I would be happy 
to meet with you and other staff members to facilitate this process. 

My action officers for the study are Messrs. William Freestone and Jeff 
Gaynor. They can be contacted at: (703) 602-5878 and 602-5876 respectively. 



Sincerely, 
Barbara L. Valeri 

Director of Information Systems Security 



Enclosure 



Review of the National Research Council Statement of Work 
Study Proposal Number 94-CPSMA-154 
"National Cryptography Policy" 



1 . The proposed study will require access to extremely sensitive information, the 
divulgence of which could cause grave damage to the nation's security. 
Accordingly, the following security specifications should be added to the 
Statement of Work (SOW) to bring the study Into compliance with national 
regulations for tiie handling of Special Intelligence and cryptographic information. 

a. The SOW contemplates the clearing of up to 5 panel members for access 
to Sensitive Compartinented Information (SCI). Inasmuch as tiie panel will require 
administrative support, the number of panel members cleared to SCI should be 
limited to three with a similar number of administrative/clerical personnel being 
cleared to the same level. 

b. The SOW should specify when security clearance applications will be 
submitted. 

c. The SOW should include a provision that access to classified data is 
contingent on the successful completion of required background checks and 
investigations, and the execution of non-disclosure agreements. 

d The SOW makes reference to NRC "review procedures." Materials 
describing tiie procedures should be forwarded to this office for review in order for 
the Department to determine if tiiey are appropriate in tiie context of the proposed 
study. Once approved, include the review procedures in the SOW. 

f. Include in the SOW a provision which requires submission of the report to 
DoD for security review (to prevent inadvertent disclosures of classified 
information), before the study is published in final form. 

2. The Prnifict Content portion of the SOW should include the NBC's study of: 

a. Current and anticipated demand for information systems security. 

b. The impact of foreign restrictions on the use of, and market for, 
cryptographic technology. 

• NOTE: Many countries impose restrictions on the cryptography 
that may be imported into their countries or connected to their public switched 
networks. This suggests that a "free market" for encryption may never exist. This 
could be a significant factor in projecting future markets. 



Enclosure 1 



c The extent to which current cryptographic policy satisfies the interests of 
privacy ■ public safety, national security, and competitiveness. In doing so 
ZiJers will be able to compare what the policy is do.ng well and what .t .s not. 

d Alternatives to current key escrow implementation. The study should 
specifically address whether key escrow encryption can implemented ,n^ 
software with assurance that communications will be secured, and that the key 
escrow mechanism can not be bypassed. 

3. The PrniPnt Content section of the SOW includes a provision that aPP^ars to 
reflect a misunderstanding of current regulations. Since there are no ^-fj^Posed 
restrictions on U.S. user use of encryption, here or abroad, query the rationale for 
stXinrthe Impact of restrictions on "the competitiveness and performance of 
commercial US users of such technology. " 



Comparison of the National Researcln Council Response 
to DoD ISS Letter of 2 May 1 994 
Study Proposal Number 94-CPSMA-154 
"National Cryptography Policy" 

The NRC has responded to our 2 May 1994 letter. Below is an analysis of their 
response to the issues raised in our letter and a copy of their response. 

ISS Letter - Paragraph la: The SOW contemplates the clearing of up to 5 panel 
members for access \o Sensitive Compartmented Information (SCI) Inasmuch as the 
panel will require administrative support, the number of panel members cleared to SC 
should be nmited to three with a similar number of administrative/clerical personnel 
being cleared to the same level. 

NRC ^^xiom& Pmmsi nm mtes SCI Dtltets for mc are ufwlntaitted by the 
tW^KS. the mo will decide how many Of what varietyjpan^l 
meS^l o%dS^^^^^ People areoteamd for access to SCI or. a strict 

;iiSMi 

ISS Letter - Paragraph lb: The SOW should specify when security clearance 
applications will be submitted. 

NRC ResD<»»se Aiwry^s: OeararK^ packages wilj ba forwarded to DoD ASAK um 
S Tao^S; with Puhtfeiaw 103-160 (Daf^a Authorfe^.». Aot of FV 
1994) It W antK^^ad wo will to tha fullest dagraa possible axpadita tha procassmg 
of security claafancas for tha study. 

ISS Letter - Paragraph 1c: The SOW should include a provision that access to 
classS data is contingent on the successful completion of required background 
checks and investigations, and the execution of non-disclosure agreements. 

NRC Responsa A*iaiy^^^^B 

ISS Letter - Paragraph Id: Tha SOW makes reference to NRC "review procedures. " 
MLriris descrlbing'tha procedures should be forwarded to this office Jor^^^^^^^^^^ 
order for the Department to determine if they are appropriate the context of the 
proposed study. Once approved, include the review procedures in the SOW. 



NRC ResDOusa Atialyaia; mC provided tha "/wo separam smps^ <xi X>n^^ ^^T^^n 

rZ^s'- As such, tha steps hava nothing to do with the sacunty ooncarns or 
damage to na^nat sacawity tatsed l?v us in item 1 d. 



The mc does note that indMduals with security dearances will review ^ostensibty 
for ^nteSecTuaf imeg^m any dasstffed portions of the study. Regardless.. .th« 
question of NRC securJiy re\^w procedures r^alns unanswered, 

ISS Letter - Paragraph If: Include in the SOW a provision which requires submission 
of the report to DoD for security review (to prevent inadvertent disclosures of 
classified information), before the study is published in final form. 

NRC Response Anaryslsf Concur. 

ISS Letter - Paragraphs 2a through 2d: The Project Content portion of the SOW should 
include the NRC's study of: 

a. Current and anticipated demand for information systems security. • 

b. The impact of foreign restrictions on the use of, and market for, 
cryptographic technology. 

• NOTE- Many countries impose restrictions on the cryptography that 
may be imported into their countries or connected to their public switched networks. 
This suggests that a "free market" for encryption may never exist. This could be a 
significant factor in projecting future markets. 

c The extent to which current cryptographic policy satisfies the interests of 
privacy, public safety, national security, and competitiveness. In doing so, reviewers 
will be able to compare what the policy is doing well and what it is not. 

d Alternatives to current key escrow implementation. Specifically address, the 
question: If the encryption algorithm resides in software, can key escrow be 
implemented with assurance that communications will be secured, and that the key 
escrow mechanism can not be bypassed? 

NRC Respbrtse Analyslsj Coricur. The above items wiJi be included in the study. 



ISS Letter - Paragraph 3: The Prnjfint Content section of the SOW includes a 
provision that appears to reflect a misunderstanding of current regulations. Since 
there are no U.S. imposed restrictions on U.S. user use of encryption, here or abroad, 
query the rationale for studying the impact of restrictions on Jthe competitiveness and 
performance of commercial US users of suet) technology. " 

NRC Response Analysis: While there are currently no restrictions on the American use 
of encryption, the impact of possible restrictions - . , /s a matter of some concern 
within the commumty. " Thus the topic wilt be covered in the study. 



ISS Bottom Line: The NRC has attempted to meet most of our ^^^^^y requ. emem^^^ 
However, from Its response to our paragraph Id, it appears the NRC lack^ form^^ 
house security "review procedures. " Recommend this issue be r^'^ed ^th the NRC 
"n subsequent correspondence and that the study not be allowed ° P-^^^f^^ untH NRC 
Security procedures for this study are approved by DoD and included m the SOW. 
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SECTION 8 

IJPPLIES OR SE^^VICES PRICES/COSTS 



Pursuant to Section 267 of the National Defense Authorization Act 
Tor Fiscal Year 1994, a study snail be conouctec bv tne National 
f^esearcn Council of the National Acaaemy or Sciences (Contractor). 

The stuay entitled: "Comorehensi ve Indeoenoent StuOy of National 
Cryptograpnic snail assess: 

(1) The effect of cryptographic technologies on: National security 
interests of the United States Goverrr^nt, Law enforcement interests of 
the United States Government, Commercial interests of United States 
industry, Privacy interests of United States citizens; ana 

(2) The effect on commercial interests of United States irx^ustry of 
export controls on cryptographic technologies. 



ITEM 



DESCRIPTION 



>JANTITY 



J/ 1 



UNIT p^rcE 



A^MOUNT 



0001 " Comorenens 1 ve Inaeoendent St^iOy of 
National Cryptographic Policy" 



-.00 



^'93735. 000000 



798.735.00 



0002 Reports and Other Deliverable 



1.00 lT 



NSP 



0002AA MEETINGS (Corniittee, Dissemination, ana As Reauired 
Staff) 



NSP 



0002A8 FINAL REPORT (In accordance w,tn the ; r,Q , - 

PRODUCT AND DISSEMINATION PLAN as ^pt 



as set 

forth in tne Contractor's oroDOsai). 



TOTAL E5TDIAIED COST: S 798, 735. 00 
■:no of sect I 'ON a 



0ASWO1-94-C-O178 



3-1 



.£-:tign c 
:iscriptiom/specs. /work statement 



. INCORPORATION OF TECHNICAL PROPOSAL 

Contracxor snail furnish the necessary personnel, ma-cenals, 
facilities, ana other suppl ies/ services as soecifiea in its tecnmcai 
proposal entitlea: "National Cryptograpny Policy" (Originai - catea 
March 1994; Rev i sea - dated June 1994). The tecnmcai orcoosal, as 
revisea, is nereoy incorooratea at SECTION J, Attacnment ffl. 



C-2. ENGLISH LANGUAGE DOCUMENTATION 

All Contractor-preparea material to be furnisned unaer tms 
contract shall be written in tne English language, ana all measurements 
snail be m tne English Linear measure and avoirauoois weiont systems. 



OASW01-94-C-0178 



C-1 



SECTION '-^ 
-CKAGING AND MARKING 



D.l :'*^.ETHO0 OF TRANSMISSION (TOP SECRET) 

Top secret material may oe transmitted Dy (i) a soecifically 
designated escort or courier cleared for access to TOP SECRET information 
(military, US civilian employee, or a resoonsible emoioyee designated by 
the contractor, exceot the contractor's emoioyee snail not carry 
Classified materia! across international boundaries) or, (ii) Armed Forces 
Courier services using a contractor assigned ARFCOS account number. Under 
no circumstances shall TOP SECRET material be transmitted through the US or 
company mail channels. 



0.2 PACKAGING AND MARKING OF CLASSIFIED ITEMS - 

(a) CONFIDENTIAL or SECRET material will be paciced to conceal it 
properly and to avoia suspicion as to contents, and to reach destination in 
satisfactory condition. Internal markings or internal oacicagmg will 
clearly inaicate tne classification. nO NOTATION TO INDICATE 
CLASSIFICATION WILL APPEAR iN EXTERNAL ^ARKIUGS, , See paragraph 17 of the 
Industrial Security Manual for Safeguaromg Classified Information, OcO 
5220. 22 -M.) 

(b) CONFIDENTIAL or SECRET documents will be enclosed in two (2) 
opaque envelopes or covers. The ^nner envelope or cover containing the 
documents being transmittec will be accressed, retjrn addressed and sealed. 
The classification of tne coc^ments De-.r.q transmitted wi il be clearly 
marked on the front ana back of the inner container. The classified 
documents will oe protectea from airect contact --.tn the inner cover py a 
cover sheet or oy foloing inward, fzr SECRET documents, a receipt form 
identifying the addresser, aacressee ana documents -ill be enclosed in the 
inner envelope. CONFIDENTIAL documents -ill be covered Dy a receipt only 
when the senoer aeems it recessary, '-e inner envelooe or cover will be 
enclosed in an ooaoue outer envelooe c cover, '-e classification -rarKings 
of the inner envelooe sno^- .c "ct be cetectaoie. '-e outer envelooe w. ■ • ce 
aadressea. return aacressee ara sea ec. '.J ClASS ! ' iCA' IC.S' MARKINGS mill 
APPEAR ON The OuTER EnvElOPE OS COvE^. 



END OF SECTION 0 
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^S?ECT:ON AMD ACCEPTANCE 



£.1 52.246-9 INSPECTION OF RESEARCH anQ DEVELOPMENT (SHORT FORM) (APR 1984) 

(Reference 46.309) 

E.2 . 252.246-7000 .MATERIAL INSPECTION AND DECEIVING REPORT (DEC 1991) 
(Reference 46.370) 



END OF SECTION E 
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=.:. 247-34 ".3.3. CESTlNAriCN (NOV '.991^ 

: Reference d7.303-6rc)) 

TERM OF CONTRACT 

The term of this contract from 30 Seotenioer 1994 through 31 May 1997. 



•'•3 PLACE OF DELIVERY (CORH- . 

All items to be delivered under this contract shall be delivered to \ 
the Contracting Officer's Reoresentat i ve (COR) at the location(s) soecifieo 
relow: 

^.-r. Jeffrey R. Gaynor (QSO. Director of Information Systems Security) Room 
3C-341, The Pentagon Washington, CC 20301 -3C40. 



- .4 



REPORTS AND OTHER DELIVERABLES 

Delivery of all reoorts and other delweraoies snail be maoe to the 
address soeciHed m Section f accordance witn the following: 

ITEM NO DESCRIPTION c^TE fen or Before) 

GC02AA .-eetings required 

00a2A8 -mal Reoort :n accordance wi.n Contractor 

'echmcal Proposal: Product 
and Dissemination Plan (p/4) 



iND OF SECTICN F 
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i£CTIOiN G 
-'.'TRACT ADMINISTRATION DATA 



^52.201 -7000 CONTRACTING OFFICER'S REPRESENTATIVE (DEC 1991) 

(a) Definition. "Contracting officer.'s reoresentati ve" means an 
individual designated ,n accordance -,tn subsection 201.602-2 of the 
Defense Federal Acquisition Regulation Suoo.en^nt and authorized in writing 
by the Contracting Officer to oerform soecific technical or administrativ? 
functions. 

(b) If the Contracting Officer designates a contracting officer's 
reoresentative (COR), t.-.e Contractor w,n .eceive a copy of the written 
designation. It will specify the extent of the COR's authority to act on 
behalf of the Contracting Officer. The COR is not authorized to nuike any 
co™„tments or changes that wil] affect "Jnce. quality, quantity, delivery 
or any other term or condition of the contract. 

(End of clause) 



VOUCHERS 



.a) vouchers, -.centified 6y contract numoer. including oeliverv oroer 
numoer. it aooiicaole. ^,tn suooorting statements, snail be suttnitted for 
review and provisional approval to the cognizant audit agency listed below: 

>^fTo7ls%l]r" ' ^'-e. Suite 101 Landover. 

(b) One (1) copy of eacn voucner snail De mailed to the Contracting 
Officer s Representat-.ve at tne adaress listed below: 

3c'"84f 'JhrPent!'""'" '''' '"^''"^ °'' ^yste^s Security) Roo. 

Ji,-04l. [he Pentagon wasmngton. DC 20301-3040 



--u£Ga:;cn -ornos;:-' cC'jrsACT -c^inistration 

-he following contracting administration office is nereoy aesignateo 
as the authorized representative of tne Contracting Officer for the 
purpose of administering tnis contract ,n accordance with current 
directives: 
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G.4 



Office of Nava) Resident Researcn Reoresenwn ve (CnRRR) 101 Marietta 
^ower. Suite 2805 Atlanta, GA 30323-0008 



CONTRACTING OFFICER'S REPRESENTATIVE 

(a) The Contracting Officer's Reoresentat we (COR) unaer this 
contract is Mr. Jeffrey R. Gaynor (OSO, -Director of Information Systems 

^n^n'M^'^'"^''^^ '^'-'''^ '^'^''^ '''^ Washington, 

DC 20301-3040. 

(b) The Contractor ,s aovisea that only tne Contracting Officer can 
Change or mooify tne contract terms or take any other action which 
ODiigates tne Govern««nt. Then, sucn action must De set forth in a formal 
mocfication to the contract. '-e autnor,,, cf t,.e COR is strictly limited 
to the SDeciTic cuties set rortn ,n n,s/ner .etter of aDoointment. a cooy 
or whicn ,s rurnisneo to the Contractor. -.-.tractors .no rely on airection 
from other than the Contracting Officer or a COR acting within the strict 
limits of his responsioilities as set fortn -.n ms/her letter of 
appointment do so at their own nsk ana expense. Such actions do not bind 
the Government contractually. Any contractual questions Shall be directed 
to the Contracting Officer. 



OF SECTION G 
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lECTICN H 
SPECIAL CCNTRACT REQUIREMENTS 



PAPERWORK REDUCTION ACT 

in the event that it Decomes necessary to collect information upon 
'centical forms from ten or more oersons otner tnan federal emoloyees • tne 
Paoen^rk Reduction Act snail aooly to tms contract, ana the contractor 
snail obtain througn the COR the reouireo OOD clearance. No funds will be 
expended or any contracts maae for the collection of data from public 
respondents until the contractor is given written notice by the contracting 
officer. 



^•^ MILITARY SECURITY CLASSIFICATION 

Military security requirements in zr.e oerformance of tms contract 
srail be maintainec ^n accordance w.tn FAR 52.2C4-2. Security Reouirements 
'.r.a the 00 Form 254 contained in Section J. T-e n.gnest classification 

-volved in tne perrormance of this contract is TOP SECRET. Tr.is contract 
cocument is UNCLASSIFIED >y m > - * - ^ - • . 

• Axl anaividuais requirine: access to collateral information 
m connection with this contract v/ill be orocessed for the aoDroDriate level 
of clearance through the Defence Lndustrial Clearance Office* (DISCO) . Cleared 
individuals will also be required to comply with all security practices, 
procedures, and regulations to pre/enr loss or compromise of classified national 
^••^ INCORPORATION OF CERTIFICATIONS secuTity information. 

... "??epresen tat ions. Certifications ano Other Statements of 

■.rrerors", Section l, "I .-.struct ions, Conaitions, ana Notices to Offerors or 
.-oters" ana Section M, -Evaluation Factors for Awara", aUnougn withdrawn 
at time of awara. are hereoy mcorporateo Oy reference with the same force 
ara effect as if stateo m fu i 1 text. 



SPECIAL ACCESS AND COMPETITIVE PROCUREMENT 
(a) Proprietary Data of Thira Parties. In tne event the Contractor 
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--oues« access to oroor,etary aata of ctner cc^oanies. m craer to conouct 
s-..o,es ana researcn .noer the contract. ••.^,11 enter ,nto agreements witn 
-..-.e suoo.y,ng comoames to orotecx s.cn.aata from unautnonzeo use or 
cisclosure so long as sucn cata remains- croonetary. 



(b) Proonetary Oata furn, sneo Dy tne Government. In tne event the 
Contractor ,s g,ven access Oy c-e Gcvern^nt to oroonetary aata of tne 
Government or oroer,etary aata of tn,ro oarties oossessea Dy tne 
Government, tne Contractor nereoy agrees to orotect sucn data from 
.nautnonzeo use or aisclosure as long al sucn aata remains oropnetary. 



5 PRE-CONTRACT COSTS 

All costs incurred on or j-ter i' J-Y. : 994 by tne contractor in 
anticipation of tn,s contract. .n,cn ,f .-curreo after the effective oate of 
tms contract -ouia nave oeen cons.cereo allowaoie costs hereunoer. snail be 
ollowaole costs r^r^ooer; srov.oed. however, sucn costs snail not exceed 
S50.000.00. 



"•6 INCREMENTAL FtNOI.NG 

This contract snail se s.=:ect tc incremental f.r.a-.nc . , tn 
5 $400,000.00 

presently available for oerforxance. :-. -s est-..Ta-.ea tnat t.-e funas 
presently availao!^ are Suffic:ent to =ern„t t.-.e contractor's serfor-anc. 
•.hrougn 30 Seotemoer. 995 

;n accorsance - -.re Se- - ? «o« •--_,„, 

••• -■ - = -a'. . . e •jc-.err.ment -cr cayment of 
-<:ney in e.cess of i $i00.CCC.:C ' 

snail ar-se unless ana untii aca:f.cral f..-cs are mace avaT.aole Oy tne 



Ccntracting Orr^cer t.-.rouqn a -co i f . -at lor or 



-.'.s ccr.tr act. 
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7 ALLOWABLE COSTS 

For the term of tms contract, tr.e. Contractor will be reimoursed for 
allowable costs in accordance witn FAR Subcart 31.2. 



H.8 CONTRACTOR VISITS 

AC the request of the Contractor, the Contracting Officer's Representative 
(COR) will coordinate Contractor visits to a sponsor's agency and other DoD 
agencies necessary for performance under this contract. 
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SECTION I 
:CNTRACT CLAUSES 



:.l 52.252-2 CLAUSES INCORPORATED BY REFERENCE (JUN 1988) 

This contract incorporates one or nxjre clauses by reference, with the 
same force and effect as if they were given ^n full text. Uoon request, 
the Contracting Officer will make tneir full text available. 

(End of clause) 

1.2 52.202-1 DEFINITIONS (SEPT 1991) 

(Reference 2.201) 

1.3 52.203-1 OFFICIALS NOT TO BENEFIT (APR 1984) 

(Reference 3, 102-2) 

1.4 52.203-3 GRATUITIES (APR 1984) 

(Reference 3.202) 

1.5 52.203-5 COVENANT AGAINST CONTINGENT FEES (APR 1984) 

'.Reference 3.404fc)) 

:.5 52.203-7 ANTI-<ICKBACIC PROCEDURES (OCT :9S8) 

(Reference 3.502-3) 

1.7 52.203-10 PRICE OR FEE ADJUSTMENT FOR ILLEGAL OR IMPROPER ACTIVITY (SEP 1990) 

(Reference 3. 104-10(c); 

1.8 =2.203-12 u IMITATION ON PAYMENTS TO INFLUENCE CERTAIN FEDERAL TRANSACTIONS (JAN 

1990) 

(Reference 3.8C8(b)) 

1.9 52.204-2 SECURITY REQUIREMENTS (APR 1984) 

(Reference 4.404(a)) 

MO 52.209-6 PROTECTING THE GOVERNMENT'S INTEREST WrtH SUBCONTRACTING WITH CONTRACTORS 

DEBARRED, SUSPENDED. C.^ ?9GdOSE: FOR DEBARMENT TNOV 1992) 
.Reference 9.^C9rD)) 

52.215-1 EXAMINATION OF RECORDS 8V CCMPTROLLER GENERAL (FEB 1993) 

(Reference 15. 106-l(b)) 

1.12 52.215-22 PRICE REDUCTION FOR DEFECTIVE COST OR PRICING DATA (JAN 1991) 

(Reference 15.804-8(a)) 
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1.13 52.215-23 



1.14 52.215-27 



1.17 52.215-39 



1.22 52.222-35 



:.24 52.222-37 
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PRICE REDUCTION FOR OEFECTWE COST OR PRICING DATA-MODIFICATIONS 
(DEC 1991) 

(Reference 15.804-8(6)) 

TERMINATION OF DEFINED 3ENEFIT PENSION PLANS (SEP 1989) 
(Reference 15.a04-8(e)) 



1.15 52.215-30 rAClLITIES CAPITAL COST OF MONEY (SEP 1987) 

(Reference i 5.904(a)) 

1.16 52.215-33 ORDER OF PRECEDENCE (J^ 1986) 

(Reference 15.406-3(b)) 



REVERSION OR ADJUSTMENT OF PLANS FOR POSTRETIREMENT BENEFITS OTHER THAN 
PENSIONS (PRB) (JUL 1991) 
(Reference 15.S04-8(f)) 



:. -B 52.216-7 ALLOWABLE CC3T AND PAYMENT (Jll 1991) 

■'.Reference i6. 307(a)) 

1.19 52.216-11 I COST CONTRACT-..NO FEE (APR 1 984 )-ALrERNATE I (APR 1984) 

(Reference 16.307(e)(2) 

1.20 52.216-15 PREDETERMINED INDIRECT COST RATES (APR 1984) 

(Reference i6.307(i)) 

1.21 52.222-26 EQUAL OPPORTUNITY (APR 1984) 

(Reference 22.510(e)) 



AFFIRMATIVE ACTION FOR SPECIAL DISABLED AND VIETNAM ERA VETERANS 
(APR 1984) 

(Reference 22. i3CS(a){ ; 



52,222-36 ArriRMATlvE ACTION FO?. handiCAPPEO WORKERS fAPR ^9a4^ 

Reference c2. \ -^Zci a) t 



-O^PLOYMENT REPORTS ON SPECIAL DISABLED VETERANS AND VETERANS OF THE 
VIETNAM ERA (JAN 1963) 
(Reference 22.1308(b)) 
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1.25 52.223-2 



CLEAN AIR AND WATER (APR 1984) 
(Reference 23.105Cb)) 



1.26 52.223-6 DRUG-FREE WORKPLACE (JJL 1990) 

(Reference 23.505(b)) 

1.27 52.227-14 RIGHTS IN DATA— GENERAL (JUN 1987) 

(Reference 27.409(a)(l ) 

1.28 52.227-21 TECHNICAL DATA CERTIFICATION, REVISION, AND WITHHOLDING OF PAYMENT- 

.^AJOR SYSTEMS (JUN 1987) 
(Reference 27.409(a)) ^ 

1.29 52.230-3 DISCLOSURE AND CONSISTENCY OF COST ACCOUNTING PRACTICES (AuG 1992) 

(Reference 30. 201 -4(b)) 

1.30 52.230-4 CONSISTENCY IN COST ACCOUNTING PRACTICES (AUG 1992) 

(Reference 30. 201 -4/'c ) ) 

:.31 52.230-5 -OMINISTRATION OF ZjS^ ACCOUNTING S-ANOAROS (AUG 1992) 

(Reference 30.201-4rd)) 

1.32 52.232-9 LIMITATION ON WITHHOLDING OF PAYMENTS (APR 1984) 

(Reference 32. Ill (c)(2) 

1.33 52.232-22 LIMITATION OF FUNDS (APR 1984) 

(Reference 32.70S-2(c)) 

1.34 £2.232-23 ASSIGNMENT OF CLAIMS (JAN 1986) 

(Reference 32.S06(a)( 1 ) 

1.35 52.232-25 PROMPT PAYMENT (MAR 1994) 

( Reference 32 . 508( c ) } 

:.36 52.232-28 ELECTRONIC FUNDS "ansFES ^mYment --I'-OCS '--5 *?S9) 

; .Reference 32 . 903 ( cJ i ; 

1.37 .52.233-1 I DISPUTES (.^.AR 1594 )--ALrERNATE : CiC 1991) 

(Reference 33.215) 

1.33 52.233-3 I PROTEST AFTER Av^aRD (Jun '.9c5)-al7ERNATE I (JUN 1985) 

(Reference 33. lC6(b)) 
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1.39 52.242-1 

1.40 52.243-2 V 

1.41 52.246-25 

1.42 52.249-5 

1.43 252.203-7000 

1.44 252.203-7001 

1.45 252.203-7003 

1.46 252.215-7000 

1.47 252.223-7004 

1.48 252.227-7018 

1.49 252.227-7029 
:.50 252.227- 7030 
1.51 252.227-7037 

0ASW01-94-C-0178 



NOTICE OF INTENT TQ OISALlOW COSTS (APR 1984) 
(Reference 42.802) 

CHANGES— COST-REIMBURSEMENT (AUG 1987)— ALTERNATE V (APR 1984) 
(Reference 43.205(b)(6) 

LIMITATION OF LIABILITY— SERVICES (APR 1984) 
(Reference 46.80S(a)(4) 

TERMINATION FOR CONVENIENCE OF THE GOVERNMENT (EDUCATIONAL AND OTHER 
NONPROFIT lNSTITUTIONSr('APP 1984) 
(Reference 49.502(d)) 

STATUTORY PROHIBITION ON COMPENSATION TO FORMER DEPARTMENT OF DEFENSE 
EMPLOYEES (DEC 1991) 
(Reference 03.170-4) 

SPECIAL PROHIBITION ON EMPLOYMENT (APR 1993) 
(.Reference ) 

^PROHIBITION AGAINST RETALIATORY PERSONNEL ACTIONS (APR 1992) 
(Reference 03. 7108) 

■PRICING ADJUSTMENTS (DEC "991) 
(Reference 15.804-8(1 )) 

DRUG-FREE WORK FORCE (SE? 1988) 
(Reference 23.570-4) 

i<ESTRICTlVE MARKINGS ON TECHNICAL DATA (OCT 1988) 
(Reference 27.403-72(a) 

iOENTIFICATION OF TECHNICAL DATA fA^^R 19S8) 
'Reference 27 . ^03-72( a ') 

•ECHNlCAL OATA.-r,; rr-MOi.0:NG jr PAYMENT (OCT 1933) 

(Reference 27. 4C3- 74(b) 

VALIDATION OF RESTRICTIVE MARKINGS ON TECHNICAL DATA (APR 19S8) 
(Reference 27.403-73(a) 
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1.52 252.231-7000 SUPPLEMENTAL COST PPINCIPLSS (DEC 1991) 

(Reference 31. 100-70) . 

1.53 252.231-7001 PENALTIES FOR UNALLOWABLE COSTS (MAY 1994) 

( Reference ) 

1.54 252.232-7005 REIMBURSEMENT OF SUBCONTRACTOR ADVANCE PAYMENTS— COO PILOT MENTOR-PROTEGE 

PROGRAM (DEC 1991) 
(Reference 32.412-70(c) 

1.55 252.233-7000 CERTIFICATION OF CLAIMrANO REQUESTS FOR ADJUSTMENT OR RELIEF (MAY 1994) 

(Reference ) 

1.56 52.203-9 REQUIREMENT FOR CERTIFICATE OF PROaiREMENT INTEGRITY— MODIFICATION 

(NOV 1990) 

(a) Definitions. 7".e aefimtions set fcrtn in FAR 3.1C4-4 are nereoy 
■ ncorporateo m zn^s ciause. 

(b) The Contractor agrees trat it - 1 i "i execute the cer-^i f ication set 
forth in paragraph (c) of this clause when recuested by tne (^ntractlng 
Officer in connection with the execution of any nxxJif ication of this 
contract. 

(c) Certification. As reouired m paraoraon (b) of this clause, the 
officer or employee responsible for tne mooif ication proposal shall 
execute the following certification: 

CERTIFICATE OF PROCUREMENT INTEGRITY— MODIFICATION (NOV 1990) 

(1) 1, [Name of certifier] am the officer or 
employee resoonsiole for tr.e preparation of this modification prcoosal 
and herepy certify cnat. to tne oest o? -r.y <nowledge and belief, with 
tne exception or any information 3escr:Dec in tnis certification, I have 
no information concerning a violation or possible violation of 
subsection 27(a). (D), (a) or (f) of the Office of Feoeral Procurement 
Policy Act. as amenaeo-^ (41 U.S.C. •^23), {hereinafter rQrerrec to as 
"the Act"), as impiementeo m tne FAR. occ-rring ounng the conauct of 
this procurement 'rcntract ana moo if ication numoer;. 

(2) As reouireo oy suosection 27(e)(l)(3) of the Act. i T'jrtner certify 
that to the oest of my <nowieage ana oenef, eacn off'.cer, employee, 

agent, representative, ana consultant of ^ 'Name 

of Offeror] who has participated personally ana substantially in the 
preparation or suomission of this proposal has certified that he or she 
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s familiar with, ana will comoiy with, ire reouiremehts of subsectioh 
27(a) of the Act, as implemented in tne ana will report immeoiately 

10 me any information concerning a violation or possiole violatTon of 
sjbsections 27(a), (b). (d), or (f) of tne Act. as implemented In the 
"AR, pertaining to this procurement. 

(3) Violations or possible violations: (Continue on plain bond paper 

f necessary and label Certificate of Procurement Integrity— Modification 
(Continuation Sheet), ENTER "NONE" IF NONE EXISTS) 



[Signature of the officer or employee responsible for the modification 
proposal and date) 



; Typed name of the officer or employee resoonsiole for tne modification 
proposal ) 

* Subsections 27(a), (b), ana (d) are effective on OecGmoer i, 1990. 
S-osection 27(f) is effective on June 1, ;991. 

THIS CERTIFICATION CONCERNS A MATTER WITHIN THE JURISDICTION OF AN AGENCY 
OF THE UNITED STATES AND THE MAKING OF A FALSE, FICTITIOUS, OR FRAUDULENT 
CERTIFICATION MAY RENDER THE MAKER SUBJECT TO PROSECUTION UNDER TITLE 18, 
UNITED STATES CODE, SECTION 1001. 

(End of certification) 

(d) In making the certification in paragraph (2) of the certificate, tne 
officer or employee of the competing Contractor responsible for tne offe'r 
cr Old, may rely upon a one-time certification from each individual 
reouired to submit a certification to tne competing Contractor, 
Supplemented by periodic training. These certifications shall be 
S3tained at the earliest possible date after an inaivioual reouireo to 
certify begins employment or association witn the Contractor, [f a 
Ccntractor aecioes to rely on a certification executed onor to the 
s-spension of section 27 (i.e.. cnor to Oecemoer 1, :939), tr.e Contractor 
s~ail ensure tnat an inai vidua! -no nas so certified is notifieo that 
section 27 has been reinstated. ^-^ese certifications snail oe naintained 
3y tne Contractor for a period of 6 years frcm tne aate a certifying 
employee's employment ^uh the company encs or, for an agency, 
representative, or consultant, 6 years frcm tne aate sucn inoivioual ceases 
to act on behalf of the Contractor. 

:e) The certification reouired by oaragrapn ^c) of tms clause is a 
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-natenal reoresentation of fact uoon wmcn renance will be olaced in 
executing this modification. 

(End of clause) 



1.57 52.215-2 II AUOIT- -NEGOTIATION (FE3 1993)— ALTERNATE II (FEB 1993) 

(a) Examination of costs. If this is a cost-reimbursement, incentive, 
time-and-materials, labor-hour, or pnce-redeterminaole contract, or any 
comoination of these, the Contractor snaU maintain— and the Contracting 
Officer or representatives of the Contracting Officer shall have the right 
to examine and audit— books, records, documents, and other evidence and 
accounting procedures and practices, regardless of form (e.g.. machine 
readable media such as disk, tape, etc.) or type (e.g.. data bases, 
applications software, data base management software, uti 1 i ties. etc. ), 
sufficient to re f lect properly all costs claimed to nave been incurred or 
anticipated to De incurred in oerforming tnis contract. This ngnt of 

- examinations snail mciude inspection at all reasonaole times of the 

Contractor's plants, or parts of them, engaged in oerforming tne contract. 

(b) Cost or pricing data. If. pursuant to law. the Contractor has been 
required to suomit cost or pricing data in connection with pricing this 
contract or any modification to this contract, the Contracting Officer or 
representatives of tne Contracting Officer who are employees of the 
Government shall have the ngnt to examine and audit all of the 
Contractor's books, records, documents, and other data regardless of form 
(e.g.. macnine readable media sucn as disk, taoe, etc.) or type (e.g., data 
bases, applications software, data base management software, utilities, 
etc.). including computations ano projections, related to proposing, 
negotiating, pricing, or performing the contract or modification, in order 
to evaluate the accuracy, completeness, and currency of the cost or pricing 
data. The right of examination snail extend to all documents necessary to 
permit adequate evaluation of tne cost or oncmg cata submitted, along 
-»th the comoutations ano orojections usea. 

■c) Reports. If the Contractor is reauired to fumsn ccst, r-'unding, zr 
performance reports, tne Contracting Or'r'-.zQr or reoresentat i ves of tne 
Contracting Officer wno are emoloyees of tne Government shall have the 
ngnt to examine and auoit Pootts, records, ctner aoc-ments, ano suo'porting 
T.atenais, for the purpose of evaluating (,1) tne effectiveness of the 
Contractor's policies and procedures to produce data compatible with the 
opjectives of these reports and (2) the data reported. 
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AvaiJabi Hty. 7he Contractor shall mane available at its office at 
ail reasonable times the materials descriDeo in oaragraons (a) and (b) 
doove, for examination, auoit. or reproouction, until 3 years after final 
payment under this contract, or for any snorter oeriod soecified in Subpart 
4.7. Contractor Records Retention, of the Federal Acduisition Regulation 
(FAR), or for any longer penoo reouireo oy statute or oy other clauses of 
this contract. In addition — 

(1) If this contract is completely or partially terminated, the 
records relating to the work terminated shall be made available for 3 
years after any resulting final termination settlement; and 

(2) Records relating to appeals under the Disputes clause or to 
litigation or the settlement of claims^ansing under or relating to this 
contract shall be made available until such appeals, litigation, or 
claims are disposed of. 

(e) Except as otherwise provided in FAR Subpart 4.7, Contractor Records 
Retention, the Contractor may transfer computer data in machine readable 
form from one reliable computer i^ium to another. The Contractor's 
computer data retention and transfer proceourys snail maintain the 
integrity, reliability, and security of -ne original data; The 
contractor's choice of form or type of materials described in paragraphs 
(a), (b), and (c) of this clause affects neither the Contractor's 
obligations nor the Government's rights under this clause. 

(f) The Contractor snail insert a clause containing all the terms of this 
clause, including this paragraph (f), in all subcontracts 

under this contract that are over the small purchase limitation in FAR Part 
13, altering the clause only as necessary to identify properly the 
contracting parties and the Contracting Officer unoer the Government prime 
contract. 

(g) The provisions of 0MB Circular No. "Audits of Inst i tuf.ons of 
Higner Learning and Otner Nonprofit Institutions" apply to this contract. 

i £no of c :a-se / 



i.53 52.242-13 BANKRUPTCY (APR i99n 

In the event the Contractor enters into proceedings relating to 
bankruptcy, whether voluntary or involuntary, zr.e Contractor agrees to 
furnish, Py certified mail, -ritten notification of the bankruptcy to ti 
Contracting Office responsible for administering the contract. This 
notification shall be furnished witnm five days of the initiation of ti 
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proceedings relating to bankruotcy filing. 7his notification snail 
•nclude the aate on wmcn the oankruotcy petition was filed, the identity 
of the court in which the bankruptcy pejiition was filed, anc a listing* of 
Governrnent contract numbers and contracting offices for all Government' 
contracts against which final oayment nas not been made. This obligation 
remains in effect until final oayment unaer this contract, 

(End of clause) 



1.59 252.204-7003 CONTROL OF GOVERNMENT PERSONNEL WORK PRODUCT (APR 1992) 

The Contractor's procedures for protecting against unauthorized 
disclosure of information shall not require Department of Defense employees 
or memoers of the Armed Forces to relinquish control of their worn 
products, whether classified or not, to the Contractor. 

:'End of ciause) 
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SECTICfJ J 
_:ST OF ATTACHMENTS 



J-K LIST OF DOCUMENTS, EXHIBITS, AND OTHER ATTACHMENTS 

The following documents, exmbits, ana otner attainments, wmch are 
'.oentified by Attachment Numbers in tms Section J. abpiy to and are a 
part or tms contract. 



ATTACHMENT TITLE PAGES 

#1 Contractor's Technical Procjosal 5 

(NAS Proposal No. 94-CPSMA-l 54) 

#2 Contract Security Classification Soecif fcation i' 

(00 FORM 254) 



Section 267, National Defense Authorization 
Act of Fiscal Year 1994 

^4 Agreement to tstaolisn tne AllowaoiMty or 

?re*Contract Costs 
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NATIONAL ACADEMY OF SCIENCES/NATIONAL ACADEMY OF ENGINEERING 

NATIONAL RESEARCH COUNCIL '^^^'^'EERING 

Commission on Physical Sciences, Mathemai.cs, and Appiicat.ons 
Computer Science and Telecommunications Board 

National ^rYpfnp,r, Dhv PQijcy 
(Origihai dated: March 1994) 
(Revised dated: June 1994) 



PROJECT SUMMARY 



fnrrs^i'^^^^^^^^ and civilian applications 

National cryptography policy ^t^^^^: i^^Zs l^^^^ 

national security, law enforcement inte^«ts and d^e n^r^tlnl !tT t ?*?"°™«^ competitiveness, 
AS pan of the Defense Authorization^VoTpY 9^/^ 

from the National Research Council (NRC^ a LlZl ^^"^^ defense is asked to request 
national cryptography policy TOs s^^ exn3^^^ '""IT °" ^^^^^raphic technologies' and 
the various .ntere«s descriL Vbove (wim TnZT.ZI ^V''''""""'" ^'''^ ''^'^^^ ^°"g 
options for balancing these ^e,S^) tLTln«r^f °" ^""^ *'^*'"°'°8y effects the policy 

and anticipated in L fUturilTa^ 41^:^^^^^^ ^!f'"°'°8ies known Voda^ 

shortcomings in the federal procertTrourwhLh ? . ""^ ^^g^^s and 

formulated as well as recTrnme^SfonsTr^mr!,? ,<=OTtography policy has in fact been 

study committee of apptSrtdy ^mel^^^^^ cryptographic policy in the future. A 

technology; cryptogrihic technobgi^ 

affairs: law enforcement; science policy tode E Inl^^ . t ' "'""""y* intelligence 

technology (hardware iid sX^ ve'n^l ^ ^ '"'^ ''"'^^^^^ 

pnvacy Si L.1 liberties NotTn^onTfo^^^^ '"^"^^^ 
boards; members of lOM. NaH" ^d oT expem. "'^'"'^ 

ORIGIN AND BACKGROUND 

Cryptographic technologies are critical to a wiH/. var,»r„ ■ 

mvolving sensitive or classified Tntaation l^ "^"'''^ applications 

addition, cn^tography is a klv comTc^^^ T T ! ^'^'""'''^ ^""^ unauthorized disclosure. In 

guarantee tSJidLfty'o a message" "^ li^^lT technologies to 

for fximre U.S. economic coSven«s nation^ cryptography policy has important implications 

on the protection of the n^tsTpr^vaTuTci^^^^^^^^^ ^'^ 

Srg^e^ri^^^^^^^^^^^^^ -nty considerations, reflecting the 

communications as well as its neT^o%aITf^^^^^^^ protection of classified and other sensitive 
would benefit from U.S.Tupenon^ in c '^^^^^^^^^ r "'""^ P"'^^^^^' '^^^ 

motivated such actions as developm^n of 7r^Sh^ t chnolog.es. National security concerns have 

aeveiopment of cryptographic technologies, development of countermeasures 
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.aKr«, and nauonal .«u„.y ,s no longer ,he sol. policy driver for ,his cl^ ofZZ^ 

A major developmenl in the pasi len years has been what could be called the n„n„i. 
cryptography. First, some industries-notably Hnancial services-have come to P""""""^""" °f 

^f-- second, rer mdut^esTvVde erot^dnreS^ 
encryption for protection ot propnctary and other sensitiv*. infn™«i«» -ru- ."''•^"7'=° ^ interest in 

cotnputers and computer -.^r ht "ge^" hf T^d 'th'nol'^^^^ 
communtcattons down to the level of individual citizens and assurTm. pnvacT^d fruntl JT' 
electronic records and transmissions Fourth th* ch,™i, • ! P"^^*^/ ana security of their 
(..g.. cellular «l.phonerr h ghlighTth! hi'Z V^l^^^^^^ f ""'""'"'=«io„s 
unauthori^d inte,«p. as wel, as thl imZiblfi^ o^SL^^'Tnt^r " 

Still another consequence of the expectation of widespread use of encryption is the emergence «f l.w 
enforcement concerns that parallel, on a civilian basis snm^ «f fh. .1 emergence of law 

ia^^^T^L^h-lTrp'g^rl^nr^^^ 

.^Clipper Chip. -cess,o,h2:dUa;Lt„n7„:;?="brp=^;:;^r^^^^^^^^^^ 

fo^So^th^e'S^^^^^^^ 

As part of the Defense Authorization Bill for FY 1994 the Secretan, nf n.fi.„« j . 

comprehensive study from the National Resi^rrh rT' 1 ^^''"^ ^'^^'^"^e is asked to request a 
cryptography policy °" '='>'P^°graphic technologies and national 
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ATTACHMENT #1 Page 3 of 5 

PROPOSED ACTIVTTY 

Proieci Conteiii 

[t is expected that the study will address: 
' lec'hZgy o°n Poss.ble'.ft.ture restnctions on and standards for cryptographic 

^ the availability of such technology to foreign and domestic parties with interests hostile 
to or competKive w.th the national security, economic, commercial, and privacy 
mterests of the U.S. government, U.S. industry, and private U.S. citizens. 

^ ;;;^^°"^P«'"^'^"«^ °f U^S. manufacturer, of such technology in the international 

^ the competitiveness and performance of commercial U.S. users of such technology. 
+ U.S. national security and law enforcement interests: 

Che strength of various cn^ptographic technologies known today and anticipated in the ftiture that 
are relevant tor commercial and pnvate purposes; 

current and amicipated demand for information systems security based on cryptography; 
technT^°*^ restrictions on the use of, importation of, and the market for cryptographic 

the extent to which current cryptography policy is adequate for protecting U.S. interests in 
pnvacy, public safety, national security, and economic competitiveness: 

technical strengths and weaknesses of current key escrow implementation schemes: 

how technology now and in the future affects and will affect the feasible policv options for 
balancing the national secunty .and law enforcement mterests of government and the privacv and 
commercial interests ot U.S. industry and private U.S. citizens: 

recommendations for the process through which national security, law enforcement, commercial 
and pnvacy interests are balanced in the formulation of national cryptography policy. 

Project Structure 

CSTB will assemble a committee of approximately 16 members that will include expertise in computer 
and communications technology; cryptographic technologies and cryptanalysis foreign national 
secunty. and intelligence affairs: law enforcement; science policy; trade policy; comme^^a U^'d bu in s 
dimen ions of computer technology (hardware and software vendors, users of cryptograph,? 
technologies); and interests in pnvacy and civil liberties. Nominations for the committee wUI be sought 
from relevant oversight boards; members of [OM, NAS. and NAE; and other experts. 

NAS Proposal No. 94-CPSMA-154 
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To complete the study, the project plan calls for six three-day meetings of the ftjii committee .^h. 
meetmgs ot sub-committees as appropriate. committee and other 

It is expected that this study will require the handling of sensitive and highly classified infnr™,. 
extra time and sufT effort has been planned to accommodate this fact. A subpa^errf the L l ' 
win e cleared at the SimC level and have access to all relevant informat on 

conclusions, and recommendations of the unclassified report are consistent with v^h JTknlln f^' 
classified world. Access to classified data is understood o be contingent on tl^e s^^es ful T 

: :,?nTV"''"""' °" and sL^^^^^^^^^^ 

of non-disclosure agreements by those individuals. execution 

The National Academy of Sciences has prepared and maintains a Standard Practice Procedures fSPP^ 
Manua that implements the requirements of the DoD Industrial Security Manual OSM) -^e s^^^^^ 
m^ual has been reviewed and approved by the Defense Investigative Ser^cc. TT^e smdy wilUonfoL 
to all requirements and procedures specified in the SPP manual related to classified infonl^Ition 

The project plan calls for the following steps in report preparation. After the committee has completed 
us deliberations, a draft report will be prepared and revised in accordance with committee dTe^ bn 

c?el f mSp ^ "^'^"''"y below) Afttr Z lon 

Aft^NRr HV ''"7- "J^"'^'' " '"'^"'^"y organization, consistency, IndclX 

After NRC editing which ,s a major step in the repon preparation process, the report win bTread^for 

the report by the NRC, after which the report w,|| be transmitted to the Secretary of Defense and 
dissemination activities will begin as described below. ' uerense and 

PRODUCT AND DISSEMINATION PLAN 

In accordance with Public Law 103-160. the Defense Authonzation Bill for Fiscal Year 1994 th. 
project plan calls for the study w.ll be delivered to the Secretary of DefeL app oxiLt " Z y^ 
after full processing of all necessary secunty clearances. However, the NRC wUI make everTrttemm 
K yr '^^n'""*^ ""^ 'hat the core woric of the study wiU beTomS 

about 18 to 20 months after execution of the award instrument for funding theTtudy ^ 

The final report of the study comminee would be subject to NRC review procedures It is the intent 
annexes as necessary. The NRC review procedures will ensure that only individuals with aDoroonate 
n™ ' " ^'-'^^^ — • should such ZZTsZ 

r?v!e™l'rt'^^^^^^^^ the Depanment of Defense prior to publication in final fortn for secunty 
,r / 1 . . ^'^"^ " 'nadveitently disclosed. The govertiins statute orovides 

h' . . °" '''' ^"'""'"'^^ 'o 'he Secretar^^f D^Lsft^S^re^^ 

of the Senate and House of Representatives in unclassified form, with classified annexes as necess^^ 

It is expected that when the Secretary submits the report to Congress, the NRC would hold a oress 
conference to discuss the unclassified version of the report. In accordance with Uie Academy s bro^^^^^ 
charge to disseminate its work widely so as to promote a more infonned publicltssirn of tL issu^^^^ 
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the NRC will also publish the unclassified version of th*. r.n«,. , w . 
tor several months foilow.ng the inhial 

typica' for ail major NRC repons. ^"^'^ dissemination efforts are 



REPORTS 



Presidential Executive Order 12832 of Jan' 

established the National Research Council (NRCUeaffiJinA TT'^'a 2859. which 

the U.S. Government. Of particular rel v^e oTh^^l^' ^^'p^'"' '''^'^'^ relationship with 
to dissemmate to duly accredited oerson.TnH V m ! ' ^''^^^W^e Order directs the NRC 
gathers and collates. F-her' "exptsJ of Lt^^^^^^^^ ^^t"-' .0^10' U 

grants-.n-aid and contracts by executive departmenL^nH P*"* ^^e Academy through 

award by a department or agency of U sTov" ' ml ''"'"'h- ^^'^'^^^y'^ acceptance of !n 
and spirit of the Executive Order whl:h proves ti f " '^°"i"°"^,."P<^" ^^^erence to the letter 
Government are expected to interact Ihe^^lJ^ framework w.th.n which the NRC and the 

contractors do not become primeTsub^u^t™^^^^ •n^-<i th« 

Executive Order requirement that the NRrdissemm^r! >/ ^ ^ departments or agencies. The 
or substantially for the purpose of hLTe such f nH " '"'"'P'''*^ ^ being primarilv 

and therefore outside the l^^itatio'ns o hVp ttm^^^ department'o' age'cv 

the attached estimate of costs is an amount p o ^^ferfo covt'rh''' "^ Accordingly, included in 
activity. P'°J^^=^ cover the cost of reproducing reports for this 

EXPENDFTURES AND SOURCES OF FUNDS 

The estimated cost of this thirty-two month activity ,s $798 735 whi.K • . • 

Department of Defense. ^ ^ 1/^8,735, which is being requested from the 
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Independent Study of National Cryptography Policy 
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•. CONTRACTOR 

b. SUBCONTRACTOR 

c. COGNIZANT SECURITf OFRCC FOR PRIME AND SUBCONTRACTOR 

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY ADMINISTRATION 

e. ADMINISTRATIVE CONTRACTING OFFICER 

f. OTHERS AS NECESSARY 
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Use and designation of Type C Consultants in accordance with paragraph 2-1 11c, Industrial 
Security Manual for Safeguarding Classified Information (ISM), DoD 5220.22-M, is 
authorized under this Contract. 

10a. Communications Security (COMSEC) Information. Secure Telephone Unit 
(STU) STU III only COMSEC Account is necessary. Access to classified COMSEC 
information requires a special briefing and a final U.S. Government clearance at the 
appropriate level. 

lOe. INTELLIGENCE INFORMATION: Sensitive Compartmented Information 
(SCI). The Cognizant Security Office (CSO) identified in Block 6c is relieved of inspection 
responsibility for SCI, but is responsible for inspections of non-SCI in the possession of the 
prime contractor. Access to intelligence information requires a final U.S. Government 
clearance at the appropriate level. 

This contract requires access to SCI. The CNR SSO (Mrs. Jane Klug) has exclusive 
responsibility for all SCI material released to or developed under this contract. Access to 
SCI is limited to that at a U.S. Government SCIF or other contractor SCIF. DIAM 50-5 and 
DoD 5105 series provides the necessary guidance. No contractor personnel will be granted 
access to SCI material under this contract unless they are filling an SCI billet. The 
contractor will coordinate with the SCI Contract Monitor to ensure adequate billets are 
requested under this contract. Multiple contract participants sponsored by organizations other 
than CNR SSO must be permanently certified to the CNR SSO for use on this contract. The 
contractor will designate a Special Security Point of Contact (POC) to the CNR SSO. The 
POC will be responsible for all personnel and information security transactions between the 
contractor and CNR SSO. The secunty classification guides for SCI are DoD 
TS-5105.21-M2+M3 and DoD TS-50d5.21-M-3. The contractor must restrict access to all 
classified information only to those individuals who possess the necessary security clearance 
and who are actually providing services under this contract. Further dissemination of SCI to 
other contractors, subcontractors, or other government agencies, private individuals or 
organizations, is prohibited unless authorized in writing from the releasing agency. 

• These supplementary requirements will be provided to the Contractor by the 
CNR SSO. 

• SCI support of this contract is under the exclusive responsiblity of the 
designated SSO and will be identified to the appropriate DIS Security Office by the 
Special Security Point of Contact. 
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• SCI will not be released to any activity or person of the contractor's 
organization not directly engaged in providing services under the contract, or to 
another contractor (including subcontractors), government agency, private 
individual, or organization without specific release approval of the originator of the 
material, as outlined in governing directive, and prior approval and certification of 
"need-to-know" by contract monitor. 

• SCI will not be released to foreign nationals or immigrant aliens who may be 
employed by the contractor, regardless of the level of their security clearance. 

• Names of contractor personnel requiring access to SCI will be submitted to the 
CNR SSO for approval. CNR SSO will submit request(s) for Single Scope 
Background Investigations in accordance with the Industnal Secunty Manual. 

• SCI data and material will be stored and maintained only in properly 
accredited facilities. Under no circumstances will SCI be furnished to the 
contractor's facility. 

• Inquiries pertaining to classification guidance regarding SCI will be directed to 
the CNR SSO. 

• The contractor will not use references to SCI access, even by unclassified 
acronyms, in advertising, promotional efforts, or recruitment for employees. 



INTELLIGENCE INFORMATION SHEET 

• Intelligence information does not become the property of the contractor and 
may be withdrawn at any time. Upon expiration of the contract, all intelligence 
released and any material using data from the intelligence will be returned to the 
contracting officer for security matters, or authorized representative for final 
disposition. Only with prior authorization may the contractor retain such material. 

• The prime contractor will not release the intelligence material to any activity 
or person of the contractor's organization not directiy engaged in providing 
services under the contract or to anoUier contractor (including subcontractors), 
government agency, private individual, or organization without prior approval. 

• Intelligence material will not be released to foreign national or immigrant 
aliens who may be employed by the contractor, regardless of the level of their 
security clearance. 

• Intelligence material will not be reproduced witiiout prior approval. 
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• The prime contractor will maintain records which wiii permit them to furnish, 
on demand, the names of individuals who have had access to intelligence material 
in their custody. 

lOj. For Official Use Only Information (FOUO). The "Far Official Use Only" 
Information provided under this contract shall be safeguarded as specified in Chapter 13, 
Section 6, ISM. 

He. Receive and generate classified material. Classification and 
regrading/declassification markings of documentation produced by the prime contractor 
and/or Type C Consultants will be consistent with that applied to the information or 
documentation from which the new document was prepared. If a compilation of the 
information or a complete analysis of a subject appears to require a security classification 
other than that of the source documentation, the material will be assigned the tentative 
security classification and request instructions from the office shown in item 16a. Pending 
final determination, the material will be safeguarded as required for its assigned or proposed 
classification whichever is higher, until classification is changed or otherwise verified. 

Only those contractor employees requiring access to classified information in the 
performance of this contract shall be granted security clearances under the Industrial Security 
Program. 

llg. Be authorized to use the services of DTIC or other secondary distribution 
center. The DD Form 1540 and DD Form 1541 will remain active and be kept up-to-date 
by the contractor for the duration of this contract. 

llh. Require a COMSEC Account. A STU-III only Account wiil be maintained by 
the contractor. 
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Acad^^y^-^^^ J^eordi CouncU of the N^Jl 
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^^^^ ^ecunty interests^ United States Geo- 

^^J^»*^<>rcementUttertst,cftUUnhedStnt^ 

(O eommeraal interesU of UrnUd States industur «»w 

Ccuncd in its actioities ^^ot^^LStZ %T^J^ National Research 
The Secrttary^kS%S^^^H^^ tudy xuuLu- this section, 
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AGREEMENT TO ESTABLISH THE ALLOWABILITY OF 
PRE-CONTRACT COSTS 
DASW01-94-R-0224 



WHEREAS, a valid and properly funded requirement exists to provide 
support to the Office of the Assistant Secretary of Defense, Director o 
Information Systems Security entitled "NATIONAL CRYPTOGRAPHY POLICY." 

WHEREAS, the proposed contractor, National Academy of Sciences (MAS), h; 
agreed to perform woric in general accordance with tAe Statement of Wor)c 
(SOW) revised dated 20 June 1994; 

WHEREAS, the government and NAS will negotiate in good, faith to reach 
contractual agreement; and 

WHEREAS, the Government requires immediate support; 

NOW, THEREFORE, in accordance with FAR 31.205-32, the following 
agreements are made pursuant to the requirements of FAR 31,109. 

FIRST: In the event that a contract is awarded, precontract costs 
not to exceed $50,000.00 shall be an allowable expense provided 
that the individual cost be incurred no sooner than 21 July 1994 and 
no precontract costs shall be allowable if incurred after 30 September 
1994 unless further written agreement is made. 

second: It is understood by both parties that any costs incurred 
prior to final agreement on the proposed contract are incurred 
voluntarily on the part of the contractor and at his/her own risk. 

The undersigned acknowledge the aforementioned agreements. 



Date: U September 199A Name: Robert R. Kelley 

Title: Manaeer of Federal Conc raf^f 




Contracting Officer 



